-
Notifications
You must be signed in to change notification settings - Fork 0
/
ELK_installer_master.sh
176 lines (156 loc) · 7.74 KB
/
ELK_installer_master.sh
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
#!/bin/bash
#
: Author: evilcomrade
#
red=$'\e[1;31m'
green=$'\e[1;32m'
blue=$'\e[1;34m'
end=$'\e[0m'
if [ "$EUID" -ne 0 ]; then
echo "${red}[+] Needs to be run as root. Exiting...${end}"
exit
else
echo "${green}[+] We are root and good to go!"
fi
# Backup existing ELK_logfile
if [ -f /var/log/ELK_install.log ]; then
mv /var/log/ELK_install.log /var/log/ELK_install_$(date +'%Y%m%d-%H%M%S').log
fi
logfile=/var/log/ELK_install.log
mkfifo ${logfile}.pipe
tee < ${logfile}.pipe $logfile &
exec &> ${logfile}.pipe
rm ${logfile}.pipe
echo "${blue}[+] Installing a few dependencies (Openjdk, nginx, openssh-server & apt-transport ) for ELK"
echo "[+] This could take a while...${end}"
apt-get update &>> $logfile
apt-get -y install openjdk-8-jre-headless apt-transport-https openssh-server nginx &>> $logfile
echo "${blue}[+] Installing Elastic PGP signing key"
wget -qO - https://artifacts.elastic.co/GPG-KEY-elasticsearch | apt-key add -
echo "${green}[+] Done"
echo "${blue}[+] Adding Elastic Packages source list definitions to your sources list"
echo "deb https://artifacts.elastic.co/packages/5.x/apt stable main" | tee -a /etc/apt/sources.list.d/elastic-5.x.list
echo "${green}[+] Done"
echo "${blue}[+] Installing & Configuring Elastic Search"
apt-get update &>> $logfile
apt-get -y install elasticsearch &>> $logfile
sed -i 's/#network.host: 192.168.0.1/network.host: localhost/g' /etc/elasticsearch/elasticsearch.yml
echo "${green}[+] Done"
echo "${blue}[+] Starting Elastic Search"
systemctl daemon-reload &>> $logfile
systemctl enable elasticsearch.service &>> $logfile
systemctl start elasticsearch.service &>> $logfile
if (systemctl -q is-active elasticsearch.service)
then
echo "${green}[+] Elastic Search is up and running."
else
echo "${red}[+] Logstash has issues check the logfile $logfile."
fi
echo "${blue}[+] Installing & Configuring Kibana"
apt-get update &>> $logfile
apt-get --force-yes -y install kibana &>> $logfile
sed -i 's/#server.host: "localhost"/#server.host: "localhost"/g' /etc/kibana/kibana.yml
echo "${green}[+] Done"
echo "${blue}[+] Starting Kibana"
systemctl daemon-reload &>> $logfile
systemctl enable kibana.service &>> $logfile
systemctl start kibana.service &>> $logfile
if (systemctl -q is-active kibana.service)
then
echo "${green}[+] Kibana is up and running."
else
echo "${red}[+] Kibana has issues check the logfile $logfile."
fi
while true; do
read -p "${red}[+] Create a password to log into our Kibana web interface:${end} " kibanapw1
read -p "${red}[+] Please confirm:${end} " kibanapw2
if [ "${kibanapw1}" == "${kibanapw2}" ]; then
break
fi
done
echo "kibadmin:$(openssl passwd -apr1 $kibanapw1)" | tee -a /etc/nginx/htpasswd.users
echo "Username: ${end}${red}kibadmin${end}"
echo "${green}[+] Password set."
echo "${blue}[+] Configuring nginx"
mv /etc/nginx/sites-available/default /etc/nginx/sites-available/original_backup_default &>> $logfile
read -p "${red}[+] Enter IP Address:${end}" IP_ADDRESS
echo "server {"> /etc/nginx/sites-available/default
echo " listen 80;">> /etc/nginx/sites-available/default
echo " server_name $IP_ADDRESS;">> /etc/nginx/sites-available/default
echo " auth_basic \"Restricted Access\";">> /etc/nginx/sites-available/default
echo " auth_basic_user_file /etc/nginx/htpasswd.users;">> /etc/nginx/sites-available/default
echo " location / {">> /etc/nginx/sites-available/default
echo " proxy_pass http://localhost:5601;">> /etc/nginx/sites-available/default
echo " proxy_http_version 1.1;">> /etc/nginx/sites-available/default
echo " proxy_set_header Upgrade \$http_upgrade;">> /etc/nginx/sites-available/default
echo " proxy_set_header Connection 'upgrade';">> /etc/nginx/sites-available/default
echo " proxy_set_header Host \$host;">> /etc/nginx/sites-available/default
echo " proxy_cache_bypass \$http_upgrade; ">> /etc/nginx/sites-available/default
echo " }">> /etc/nginx/sites-available/default
echo "}">> /etc/nginx/sites-available/default
echo "${blue}[+] Testing nginx config"
systemctl enable nginx.service &>> $logfile
nginx -t &>> $logfile
systemctl restart nginx.service &>> $logfile
if (systemctl -q is-active nginx.service)
then
echo "${green}[+] Nginx is up and running. You should be able to log into Kibana"
else
echo "${red}[+] Nginx has issues check the logfile $logfile."
fi
echo "${blue}[+] Installing & Configuring Logstash"
apt-get update &>> $logfile
apt-get --force-yes -y install logstash &>> $logfile
mkdir -p /etc/pki/tls/certs &>> $logfile
mkdir /etc/pki/tls/private &>> $logfile
sed -i "s/# Extensions for a typical CA/subjectAltName\ \=\ IP\:\ $IP_ADDRESS/g" /etc/ssl/openssl.cnf
cd /etc/pki/tls &>> $logfile
openssl req -config /etc/ssl/openssl.cnf -x509 -days 3650 -batch -nodes -newkey rsa:2048 -keyout private/logstash-forwarder.key -out certs/logstash-forwarder.crt &>> $logfile
echo "${red}[+] Your cert has been stored to the location below."
echo "/etc/pki/tls/certs/logstash-forwarder.crt${end}"
echo "${green}[+] Done"
echo "${blue}[+] Creating custom Logstash configuration files."
if [ -f /etc/logstash/conf.d/02-beats-input.conf ]; then
echo "${blue}[+] There's an existing beats input config file.. Backing it up."
mv /etc/logstash/conf.d/02-beats-input.conf /etc/logstash/conf.d/02-beats-input.conf.bak &>> $logfile
else
touch /etc/logstash/conf.d/02-beats-input.conf &>> $logfile
echo "input {">> /etc/logstash/conf.d/02-beats-input.conf
echo " beats {">> /etc/logstash/conf.d/02-beats-input.conf
echo " port => 5044">> /etc/logstash/conf.d/02-beats-input.conf
echo " add_field => { \"[@metadata][source]\" => \"winlogbeat\"}">> /etc/logstash/conf.d/02-beats-input.conf
echo " ssl => true">> /etc/logstash/conf.d/02-beats-input.conf
echo " ssl_certificate => \"/etc/pki/tls/certs/logstash-forwarder.crt\"">> /etc/logstash/conf.d/02-beats-input.conf
echo " ssl_key => \"/etc/pki/tls/private/logstash-forwarder.key\"">> /etc/logstash/conf.d/02-beats-input.conf
echo " }">> /etc/logstash/conf.d/02-beats-input.conf
echo "}">> /etc/logstash/conf.d/02-beats-input.conf
fi
if [ -f /etc/logstash/conf.d/50-elasticsearch-output.conf ]; then
echo "${blue}[+] There's an existing Elastic search output config file.. Backing it up."
mv /etc/logstash/conf.d/50-elasticsearch-output.conf /etc/logstash/conf.d/50-elasticsearch-output.conf.bak &>> $logfile
else
touch /etc/logstash/conf.d/50-elasticsearch-output.conf &>> $logfile
echo "output {">> /etc/logstash/conf.d/50-elasticsearch-output.conf
echo " if [@metadata][source] == \"winlogbeat\" {">> /etc/logstash/conf.d/50-elasticsearch-output.conf
echo " elasticsearch {">> /etc/logstash/conf.d/50-elasticsearch-output.conf
echo " hosts => [\"localhost:9200\"]">> /etc/logstash/conf.d/50-elasticsearch-output.conf
echo " sniffing => true">> /etc/logstash/conf.d/50-elasticsearch-output.conf
echo " manage_template => false">> /etc/logstash/conf.d/50-elasticsearch-output.conf
echo " index => \"%{[@metadata][beat]}-%{+YYYY.MM.dd}\"">> /etc/logstash/conf.d/50-elasticsearch-output.conf
echo " document_type => \"%{[@metadata][type]}\"">> /etc/logstash/conf.d/50-elasticsearch-output.conf
echo " }">> /etc/logstash/conf.d/50-elasticsearch-output.conf
echo " }">> /etc/logstash/conf.d/50-elasticsearch-output.conf
echo "}">> /etc/logstash/conf.d/50-elasticsearch-output.conf
fi
echo "${blue}[+] Starting logstash."
systemctl daemon-reload &>> $logfile
systemctl enable logstash.service &>> $logfile
systemctl start logstash.service &>> $logfile
if (systemctl -q is-active kibana.service)
then
echo "${green}[+] Logstash is up and running."
else
echo "${red}[+] Logstash has issues check the logfile $logfile."
fi
echo "${blue}[+] The log file for ELK is located at: $logfile."
echo "${green}[+] We should be all good."